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SPECIFIABLE USER INTERFACES 



TECHNICAL FIELD 

The present invention relates generally to user interfaces and object-oriented 
programming. In particular, this invention relates to a computerized system and method 
for displaying data related to an object in a class where the user interface for displaying 
the data is specified per object. 

BACKGROUND OF THE INVENTION 

In object-oriented programming, a class is a category that describes a group of 
more specific items, called objects, that can exist within the class. The typical class is a 
descriptive tool used in a software application to define a set of attributes, services, or 
other properties that characterize any object of the class. Each object is an instance of the 
class. Each object has an attribute value associated with each attribute defined by the 
class. 

For example, one disadvantage of the user interface for conventional software 
applications that display object-oriented data is that the user interface is not tailored 
specifically to the data being displayed. 

Presently available software applications can monitor statistics related to events 
and performance of a computer. The statistics are stored in a database and include, for 
example, processor usage, disk capacity, faults, and diagnostic messages. A user can 
select specific statistics to monitor in various ways, such as by interfacing with the 
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monitoring application or editing a text file. The monitoring application accesses the 
database to retrieve data relating to the statistics selected by the user. 

Some prior art monitoring applications use multiple classes to represent the 
statistics to be monitored. With these monitoring applications, however, users have to 
remember the different names of the classes and the statistics they represent. Other 
monitoring applications use a single generic class to represent the data. With these 
monitoring applications, the same user interface displays the data associated with each 
monitored statistic. For some statistics, this generic display is difficult to understand. 

For these reasons, improvements in object-oriented programming are desired for 
displaying data related to an object in a class. 

SUMMARY OF THE INVENTION 

The invention meets the above needs and overcomes the deficiencies of the prior 
art by providing improvements in programming. According to one aspect of the 
invention, a single, generic, collection class permits each monitored statistic to be 
represented as an object of the class. The attribute values of each object represent data 
relating to the statistic including, but not limited to, collected performance information, a 
description of the statistic, and various flags to indicate the state of the object. The 
objects are stored in a database. The invention allows a software application to access the 
objects in the database and display the attribute values of each object with a user interface 
(UI). The invention provides a UI attribute within the class that allows the user to specify 
the UI to display the attribute values of each object. Each available UI corresponds to a 
statistic to be monitored. Each available UI has a unique user interface attribute value. 
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The invention supports any number of UIs supplied by the user, an application developer, 
or a third party. 

Another aspect of the invention eliminates the need for multiple classes to 
represent the statistics to be monitored. The invention allows each monitored statistic to 
5 be represented as an object of a single class. The invention also permits the user to 
associate a specific UI with a specific statistic to be monitored. 

Briefly described, a computerized method of displaying data defines a plurality of 
attributes of a class of data. The data includes one or more objects wherein each object is 
an instance of the class. At least one of the attributes represents a user interface. The 
10 objects each have a plurality of attribute values corresponding to the attributes of the 

class. At least one of the attribute values is associated with the user interface attribute of 
the class. The method also accesses the user interface attribute value of each object and 
displays the attribute values of the object responsive to the user interface attribute value. 

In accordance with another aspect of the invention, a computer-readable medium 
15 stores a data structure representing a class that includes one or more objects. Each object 
is an instance of the class. The computer-readable medium has a first field for storing 
one or more data attributes representing data and a second field for storing a user 
interface attribute representing a user interface. Each object has an attribute value 
associated with each of the attributes. The user interface, as identified by a user interface 
20 attribute value of a specific object, displays the attribute values of the specific object. 

Another aspect of the invention is directed to a computer-readable medium having 
computer-executable components for displaying data associated with at least one object 
of a class. The class has attributes and each object of the class has attribute values 
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associated with the attributes. The computer-executable components include an access 
component and a display component. The access component accesses a user interface 
attribute value of each object. The display component displays the attribute values of the 
object responsive to the user interface attribute value. 

In accordance with yet another aspect of the invention, a system for displaying 
data includes means for defining a plurality of attributes of a class of data. The data 
includes one or more objects wherein each object is an instance of the class. At least one 
of said attributes represents a user interface. The objects each have a plurality of attribute 
values corresponding to the attributes of the class. At least one of the attribute values is 
associated with the user interface attribute of the class. The system also includes means 
for accessing a user interface attribute value of each object. The system also includes 
means for displaying, responsive to the user interface attribute value, the attribute values 
of the object. 

Alternatively, the invention may comprise various other methods and apparatuses. 
Other objects and features will be in part apparent and in part pointed out 
hereinafter. 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a block diagram illustrating one example of a suitable computing system 
environment on which the invention may be implemented according to a preferred 
embodiment of the invention. 

FIG. 2 is a block diagram illustrating communication between a monitoring 
application and a database of the computing system environment of FIG. 1. 
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FIG. 3 is an exemplary flow diagram illustrating the display of data associated 
with an object according to a preferred embodiment of the invention. 

FIG. 4 is an exemplary customized user interface for specifying the collection of 
monitoring data related to physical disks. 
5 FIG. 5 is an exemplary customized user interface for monitoring hypertext 

transfer protocol communications. 

FIG. 6 is an exemplary default user interface for specifying the collection of any 
type of monitoring data. 

FIG. 7 is a block diagram of an exemplary computer-readable medium on which a 
10 preferred embodiment of the invention may be stored. 

Corresponding reference characters indicate corresponding parts throughout the 
drawings. 

DETAILED DESCRIPTION OF THE INVENTION 

The invention generally relates to displaying data. In object-oriented 

15 programming, a class is a category that describes a group of more specific items, called 
objects, that can exist within the class. The class is a descriptive tool used in a software 
application to define a set of attributes, services, or other properties that characterize any 
object of the class. Each class has one or more attributes. Each object is an instance of 
the class and has an attribute value associated with each attribute defined by the class. 

20 The invention includes a collection class such that each statistic to be monitored is 

represented as an object of the class. The attribute values of each object represent data 
relating to the statistic including, but not limited to, collected performance information, a 
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description of the statistic, and various flags to indicate the state of the object. The 
objects are stored in a database maintained by a software application implementing the 
Web-Based Enterprise Management (WBEM) protocol such as WINDOWS Management 
Instrumentation (WMI) by Microsoft Corporation. The database stores the objects 
5 representing the collected statistics. The WBEM software application is a management 
mechanism that provides uniform data collection and data management to manage local 
and remote computer systems. A monitoring application (e.g., an application which 
monitors various event and performance statistics of one or more computers) interfaces 
with the database to collect and analyze information for a user. The invention allows the 

10 monitoring application to access the objects in the database and display the attribute 
values of each object with a user interface (UI). Preferably, the invention provides a UI 
attribute within the class that allows the user to specify the UI to display the attribute 
values of each object. In one embodiment, each available UI is suited to display data 
relating to a particular statistic and has a unique user interface attribute value. The 

15 invention supports any number of UIs supplied by the user, an application developer, or a 
third party. 

Referring first to FIG. 1, a block diagram illustrates one example of a suitable 
computing system environment 100 on which the invention may be implemented. The 
computing system environment 100 is only one example of a suitable computing or 
20 operating environment and is not intended to suggest any limitation as to the scope of use 
or functionality of the invention. Neither should the computing system environment 100 
be interpreted as having any dependency or requirement relating to any one or 
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combination of components illustrated in the exemplary computing system environment 
100. 

FIG. 1 shows one example of a general purpose computing device in the form of a 
computer 130. In a preferred embodiment of the invention, a computer such as the 
5 computer 130 is suitable for use in FIGs. 2, 3, and 7. 

Computer 130 preferably has one or more processors or processing units 132 and 
a system memory 134. In the illustrated embodiment, a system bus 136 couples various 
system components including the system memory 134 to the processors 132. The bus 
136 represents one or more of any of several types of bus structures, including a memory 
10 bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor 
or local bus using any of a variety of bus architectures. By way of example, and not 
limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro 
Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics 
Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) 
15 bus also known as Mezzanine bus. 

IrfesQomputer 130 typically has at least some form of computer readable media. 
Computer readablem^dia, which include both volatile and nonvolatile.media, removable 
and non-removable media, m^y4je any available medium that can be accessed by 
computer 130. By way of example anaiteHimitation, computer readable media comprise 
20 computer storage media and communication medi^Computer storage media include 
volatile and nonvolatile, removable and non-removable melii^implemented in any 
method or technology for storage of information such as computer r&Kteble instructions, 
data structures, program modules or other data. For example, computer storagbsmedia 
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indude RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, 
digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic 
tape, magnetic disk storage or other magnetic storage devices, or any other medium that 
can be used\o store the desired information and that can accessed by computer 130. 
Communication media typically embody computer readable instructions, data structures, 
program modules)sor other data in a modulated data signal such as a carrier wave or other 
transport mechanismYnd include any information delivery media. Those skilled in the 
art are familiar with the Vodulated data signal, which has one or more of its 
characteristics set or changed in such a manner as to encode information in the signal. 
Wired media, such as a wired Network or direct-wired connection, and wireless media, 
such as acoustic, RF, infrared, ana. other wireless media, are examples of communication 
media. Combinations of the any of the above are also included within the scope of 
computer readable media. \ 

The system memory 134 preferably includes computer storage media in the form 
of removable and/or non-removable, volatile and/or nonvolatile memory. In the 
illustrated embodiment, system memory 134 includes read only memory (ROM) 138 and 
random access memory (RAM) 140. A basic input/output system 142 (BIOS), containing 
the basic routines that help to transfer information between elements within computer 
130, such as during start-up, is typically stored in ROM 138. RAM 140 typically contains 
data and/or program modules that are immediately accessible to and/or presently being 
operated on by processing unit 132. By way of example, and not limitation, FIG. 1 
illustrates operating system 144, application programs 146, other program modules 148, 
and program data 150. 
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: computer 130 may also include other removable/non-removable, 
volatile/nonvolatile computer storage media. For example, FIG. 1 illustrates a hard disk 
drive 154 that reads from or writes to non-removable, nonvolatile magnetic media. FIG. 
1 also shows a magnetic disk drive 156 that reads from or writes to a removable, 
5 nonvolatile magnetic diskX58, and an optical disk drive 160 that reads from or writes to a 
removable, nonvolatile opticaMisk 162 such as a CD-ROM or other optical media. 
Other removable/non-removable, volatile/nonvolatile computer storage media that can be 
used in the exemplary operating environment include, but are not limited to, magnetic 
tape cassettes, flash memory cards, digitalWersatile disks, digital video tape, solid state 
10 RAM, solid state ROM, and the like. The hard disk drive 144, and magnetic disk drive 
156 and optical disk drive 160 are typically connected to the system bus 136 by a non- 
volatile memory interface, such as interface 166. 

The drives or other mass storage devices and their associated computer storage 
media discussed above and illustrated in FIG. 1, provide storage of computer readable 
15 instructions, data structures, program modules and other data for the computer 130. In 
FIG. 1, for example, hard disk drive 154 is illustrated as storing operating system 170, 
application programs 172, other program modules 174, and program data 176. Note that 
these components can either be the same as or different from operating system 144, 
application programs 146, other program modules 148, and program data 150. Operating 
20 system 170, application programs 172, other program modules 174, and program data 
176 are given different numbers here to illustrate that, at a minimum, they are different 
copies. 
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A user may enter commands and information into computer 130 through input 
devices such as a keyboard 180 and a pointing device 182 (e.g., a mouse, trackball, pen, 
or touch pad). Other input devices (not shown) may include a microphone, joystick, 
game pad, satellite dish, scanner, or the like. These and other input devices are connected 
to processing unit 132 through a user input interface 184 that is coupled to system bus 
136, but may be connected by other interface and bus structures, such as a parallel port, 
game port, or a universal serial bus (USB). A monitor 188 or other type of display device 
is also connected to system bus 136 via an interface, such as a video interface 190. In 
addition to the monitor 188, computers often include other peripheral output devices (not 
shown) such as a printer and speakers, which may be connected through an output 
peripheral interface (not shown). 

The computer 130 may operate in a networked environment using logical 
connections to one or more remote computers, such as a remote computer 194. The 
remote computer 194 may be a personal computer, a server, a router, a network PC, a 
peer device or other common network node, and typically includes many or all of the 
elements described above relative to computer 130. The logical connections depicted in 
FIG. 1 include a local area network (LAN) 196 and a wide area network (WAN) 198, but 
may also include other networks. Such networking environments are commonplace in 
offices, enterprise-wide computer networks, intranets, and global computer networks 
(e.g., the Internet). 

When used in a local irea networking environment, computer 130 is connected to 
the LAN 196 through a network interface or adapter 186. When used in a wide area 
networking environment, computer 130 typically includes a modem 178 or other means 
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for establishing communications over the WAN 198, such as the Internet. The modem 
178, which ma^tie internal or external, is connected to system bus 136 via the user input 
interface 194, or other appropriate mechanism. In a networked environment, program 
modules depicted relative to cbmputer 130, or portions thereof, may be stored in a remote 
5 memory storage device (not shown)? s By way of example, and not limitation, FIG. 1 

illustrates remote application programs 192 presiding on the memory device. It will be 
appreciated that the network connections shown are^xemplary and other means of 
establishing a communications link between the computei^may be used. 

Generally, the data processors of computer 130 are programmed by means of 
^ 10 instructions stored at different times in the various computer-readable storage media of 
i' : n the computer. Programs and operating systems are typically distributed, for example, on 

-!=ll 

: 

lU floppy disks or CD-ROMs. From there, they are installed or loaded into the secondary 

«F memory of a computer. At execution, they are loaded at least partially into the 

Ei 

; computer's primary electronic memory. The invention described herein includes these 

y = 

1 5 and other various types of computer-readable storage media when such media contain 
u instructions or programs for implementing the steps described below in conjunction with 

a microprocessor or other data processor. The invention also includes the computer itself 
when programmed according to the methods and techniques described below. 

For purposes of illustration, programs and other executable program components, 
20 such as the operating system, are illustrated herein as discrete blocks. It is recognized, 
however, that such programs and components reside at various times in different storage 
components of the computer, and are executed by the data processor(s) of the computer. 
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Referring next to FIG. 2, a block diagram illustrates communication between a 
monitoring application 218 and a database 202. In a preferred embodiment, the 
monitoring application 218 is one of the application programs 172. The database 202 is a 
data structure preferably storing data relating to the monitored statistics on a computer- 
5 readable medium accessible by computer 130. In one embodiment, the data represents 
events in computer 130 or indicates performance of one or more applications. The data 
includes statistics including, but not limited to, hypertext transfer protocol (HTTP) 
communications, Internet control message protocol (ICMP) communications, services, 
events, processes, and/or transmission control protocol/Internet protocol (TCP/IP) 

10 communications. In this manner, the database 202 organizes and stores statistics specific 
to the monitored computer, including statistics relating to one or more applications 
executing on the monitored computer. 

In one embodiment, a computer-readable medium such as database 202 stores the 
data in an object-oriented data structure representing at least one class where each class 

15 includes one or more objects. For example, in FIG. 2, the database 202 has one or more 
classes including Class A 204. Each class may have multiple objects wherein each object 
is an instance of the class. Each object includes a duplicate of the class data structure. 
Object #1 206 through Object #N 208 are instances of Class A 204. In this example, 
there are N instances of Class A 204 stored in the database 202 where N is a positive 

20 integer. For example, Class A 204 includes a user interface attribute and at least one data 
attribute. Each object includes an attribute value corresponding to each attribute of the 
class. The attribute values of a particular object represent the persistent state of that 
object. 
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FIG. 2, Object #1 206 includes an Object #1 user interface attribute value 210 
and at leasKone Object #1 data attribute value 212. Similarly, Object #N 208 includes an 
Object #N user interface attribute value 214 and at least one Object #N data attribute 
value 216. TheVnonitoring application 218 and an optional third party user interface 220 
communicate witnvthe database 202. The monitoring application 218 includes a 
maximum of M useninterfaces such as user interface #1 222 through user interface #M 
224, where M is a positive integer. The invention supports any number of UIs supplied 
by the user, an application developer, or a third party. Each user interface is associated 
with an identifier. In a preferred embodiment, the identifier is a globally unique identifier 
10 (GUID). As is well-known td those skilled in the art, the GUID is part of a global 
universal identification schemeYn which only one name is identified with a particular 
user interface. In the Componenrpbject Model by Microsoft Corporation, the GUID is a 
unique code represented by a numbqr of digits (e.g., 32 digits). For example, the user 
interface attribute may be referred to as TypeGUID. Exemplary TypeGUIDs include the 
15 strings "03B9B36 1-2299-1 Id3-BE00-0(300F87A3912" and "E2F3E715-AEE4-454e- 
AB05-D062DBBFAA0F." See AppendmA for a file which illustrates an exemplary 
class structure for monitoring various statistics. In this exemplary class structure, the 
statistics being monitored include performance counter data, component object model 
data objects, HTTP communications, WMI instances, ping (ICMP) communications, 
20 service monitor status, WMI queries, event logs, event queries, processes, and TCP/IP 
communications. The file in Appendix A also det^fls the attribute values of several 
objects of the class. 
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The monitoring application 218 communicates with the database 202 to retrieve 
selected objects and display the attribute values of each object with the user interface 
identified by ihe user interface attribute value of that object. In this example, the user 
interface would be user interface #1 222 through user interface #M 224. The user selects 
5 the objects to retrieve and display via the monitoring application 218. In addition, the 
user updates and store^the attribute values of selected objects via the monitoring 
application 218. The momtoring application 218 permits the user to modify the attribute 
values of a selected object via the user interface associated with that object. In an 
alternative embodiment, the usV modifies objects and their attribute values by editing a 

10 text file accessed by the monitorim; application. See Appendix A for an example of such 
a file. In one embodiment, the monrtoring application 218 is associated with the database 
202. \ 

Referring next to FIG. 3, a flow chart illustrates the display of data associated 
with an object. A plurality of attributes of the class of data is defined at 302. The objects 

15 each have a plurality of attribute values corresponding to the attributes of the class. The 
monitoring application (e.g., monitoring application 218 of FIG. 2) accesses at 304 the 
user interface attribute value of each object. Responsive to the user interface attribute 
value, the monitoring application displays at 306 the attribute values of the object. In one 
embodiment, the monitoring application compares the user interface attribute value of 

20 each object against a predefined list of values. The predefined list of values identifying 
specific user interfaces, wherein the specific user interface associated with the user 
interface attribute value of each object displays the attribute values of each object. For 
example, the predefined list of values may be a list of TypeGUIDs. If the accessed user 
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interface attribute value does not appear in the list, the monitoring application displays a 
default user interface (see FIG. 6). 

Editing a text file or interacting with a user interface to communicate with the 
database (e.g., database 202 of FIG. 2) constitute means for defining a plurality of 
5 attributes of a class of data. The monitoring application communicating with a database 
constitutes means for accessing a user interface attribute value of each object. The 
monitoring application with the appropriate user interface constitutes means for 
displaying, responsive to the user interface attribute value, the attribute values of the 
object. Further, the examples described above and examples described elsewhere herein 

! g 10 constitute means for defining a plurality of attributes of a class of data, means for 

in 

in accessing a user interface attribute value of each object, and means for displaying, 

! U responsive to the user interface attribute value, the attribute values of the object. 

! y 

4 s Referring next to FIG. 4, an exemplary embodiment of the invention includes a 

: % customized user interface for specifying the collection of monitoring data related to the 

I-! 15 physical disks of computer 130. When the user interface attribute value of a particular 
12 object specifies the user interface of FIG. 4, the user interface of FIG. 4 is used by the 

monitoring application to display the attribute values of the particular object. A pop-up 
window includes tabs labeled General 402, Details 404, Actions 406, Schedule 408, and 
Message 410. The Details tab 404 displays multiple input boxes for inputting a Class 
20 412, a Counter 414, and an Instance 416. In FIG. 4, the Class input box 412 indicates 
that PhysicalDisk has been input as the class to monitor. The Counter input box 414 
displays "% Disk Time" indicating that the user wants to monitor the total time spent 
accessing the disk. The Instance input box 416 displays "PhysicalDisk.Name='0 C:"' 
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indicating that physical disk C: is to be monitored. The Class input box 412, the Counter 
input box 414, and the Instance input box 416 display attribute values associated with one 
object. By editing the input boxes, the user modifies the attribute values of the object 
whose attribute values are being displayed. 
5 Referring next to FIG. 5, an exemplary embodiment of the invention includes a 

customized user interface for monitoring hypertext transfer protocol (HTTP) 
communications of computer 130. When the user interface attribute value of a particular 
object specifies the user interface of FIG. 5, the user interface of FIG. 5 is used by the 
monitoring application to display the attribute values of the particular object. A pop-up 

10 window includes tabs labeled General 502, Details 504, Actions 506, Schedule 508, and 
Message 510. The Details tab 504 displays multiple input boxes for inputting a uniform 
resource locator (URL) 512 to monitor access to and for inputting a Timeout 514 value in 
seconds. In FIG. 5, the URL input box 512 indicates that "www.cnn.com" is to be 
monitored. The Timeout input box 514 indicates that access to the URL is considered a 

15 failure if a connection is not made within thirty seconds. By editing the input boxes, the 
user modifies the attribute values of the object whose attribute values are being displayed. 

Referring next to FIG. 6, an exemplary embodiment of the invention includes a 
default user interface for specifying the collection of any type of monitoring data. When 
the user interface attribute value of a particular object is not specified or does match one 

20 of values recognized by the monitoring application, the user interface of FIG. 6 is used by 
the monitoring application to display the attribute values of the particular object. A pop- 
up window includes tabs labeled General 602, Details 604, Actions 606, Schedule 608, 
and Message 610. The Details tab 604 displays multiple input boxes for inputting a 
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Namespace 612, a Class 614, an Instance 616, and one or more Properties 618. In FIG. 
6, the Namespace input box 612 indicates that the root namespace has been input as the 
namespace. The Class input box 614 indicates that MicrosoftHM_IcmpPing has been 
input as the class. The Instance input box 616 indicates that user wishes to collect an 
5 instance with any address having a timeout value of 1000. The Properties input box 618 
indicates that the StatusDescription attribute will be monitored (as indicated by a 
checkmark in the box next to the name) and that the StatusCode, Address, Timeout, and 
ResponseTime attributes will not be monitored. By editing the input boxes, the user 
modifies the attribute values of the object whose attribute values are being displayed. 

10 Those skilled in the art will note that the user interface of FIG. 6 is generic and markedly 
distinct from the customized user interfaces of FIGs. 4 and 5. 

Although the examples of FIGs. 4-6 illustrate user interfaces for use in connection 
with monitoring software, it is to be understood that aspects of the present invention are 
applicable to collecting, managing, and displaying any type of data. 

15 Referring next to FIG. 7, a block diagram illustrates an exemplary computer- 

readable medium on which the invention may be stored. The computer readable medium 
702 has computer-executable instructions for performing the method of the invention. 
The computer-readable medium 702 includes an access component 704 and a display 
component 706. The access component 704 accesses a user interface attribute value of 

20 each object. The display component 706 displays the attribute values of the object 

responsive to the user interface attribute value. The display component includes one or 
more user interfaces. The user interface attribute value of a particular object specifies 
one of the user interfaces to display the attribute values of the particular object. 
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Although described in connection with an exemplary computing system 
environment, including computer 130, the invention is operational with numerous other 
general purpose or special purpose computing system environments or configurations. 
The computing system environment is not intended to suggest any limitation as to the 
5 scope of use or functionality of the invention. Moreover, the computing system 

environment should not be interpreted as having any dependency or requirement relating 
to any one or combination of components illustrated in the exemplary operating 
environment. Examples of well known computing systems, environments, and/or 
configurations that may be suitable for use with the invention include, but are not limited 

10 to, personal computers, server computers, hand-held or laptop devices, multiprocessor 
systems, microprocessor-based systems, set top boxes, programmable consumer 
electronics, network PCs, minicomputers, mainframe computers, distributed computing 
environments that include any of the above systems or devices, and the like. 

The invention may be described in the general context of computer-executable 

15 instructions, such as program modules, executed by one or more computers or other 

devices. Generally, program modules include, but are not limited to, routines, programs, 
objects, components, and data structures that perform particular tasks or implement 
particular abstract data types. The invention may also be practiced in distributed 
computing environments where tasks are performed by remote processing devices that 

20 are linked through a communications network. In a distributed computing environment, 
program modules may be located in both local and remote computer storage media 
including memory storage devices. 
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When introducing elements of the present invention or the preferred 
embodiment(s) thereof, the articles "a," "an," "the," and "said" are intended to mean that 
there are one or more of the elements. The terms "comprising," "including," and 
"having" are intended to be inclusive and mean that there may be additional elements 
other than the listed elements. 

In view of the above, it will be seen that the several objects of the invention are 
achieved and other advantageous results attained. 

As various changes could be made in the above products and methods without 
departing from the scope of the invention, it is intended that all matter contained in the 
above description and shown in the accompanying drawings shall be interpreted as 
illustrative and not in a limiting sense. 
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APPENDIX A 
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II HMD&faultS.Mof 

// Copyright (c)2000 Microsoft Corporation, All Rights Reserved 
// 

#pragma namespWce ( "\\\\ . \\R00T\\CIMV2\\Microsof tHealthMonitor" ) 
#pragma autorecover 

/I/ //////// // ill ih/i // 111 // ill // 111 ii ii /// // ill ill ii i/i /////// ii i/i /// 

II STATIC HIDDEN INSTANCES TO USE AS DEFAULT VALUES 

III iiiii 111 ii i mi iihiiini in ii inn in n in inn n in iiiiiiiiiiiiiu 



i n n 1 1 n 1 1 1 1 1 1 1 1 1 n i n 1 1 1 1 n n 1 1 



1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 n 1 1 1 1 1 1 1 1 1 1 



:tDataCollectorConf iguration AS 



in in n in n in ii 111 n in mn /////// 

II PERFORMANCE MONITOR 

/// /// 1 mm ii i ii 111 ii 111 ii ii mil 1 1 

/X -v. 

instance of Microsof tHM_PolledGet/obo e 
$DC1 
{ 

GUID = " { 03B9B361 - 22 99 -lld3 -BE00 ^O0O0F87A3 912 } 11 ; 
TypeGUID = " {03B9B361-2299-lld3-BE\o-OOOOF87A3912} " ; 
Name = "Performance Monitor"; 

Description = "Monitors Performance (Jpunter Data"; 
CollectionlntervalMsecs = 60000; 
StatisticsWindowSize = 6; 
Object Path = ""; 
Properties = { } ; 
RequireReset = FALSE; 

TargetNamespace = "root\\cimv2\\Microsof tHeyithmonitor\\perf mon" ; 
Enabled = FALSE; 
Hidden = TRUE; 

Message = "%Name% monitor: %State% condition, \nlnstance : 
%InstanceName%\n (WMI Status : %CollectionErrorCode% 
%CollectionErrorDescription%) " ; 
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10 



15 



20 



R^setMessage = "%Name% monitor is Ok. \nlnstance : %InstanceName%" ; 

}; 

instance ofv Microsof tHM_ThresholdConfigurat ion AS $DC1T1 
{ 

GUID = ,J V4DC9E556-8711-4944-B7C3-E8E8A679BBB9} " ; 
Name = "Eirror Code (from WMI) != 0"; 

Description^ "Verify the return error code from the Collection"; 
PropertyNam^ = "CollectionErrorCode" ; 
UseFlag = 0; 

TestCondition V 3; // "! = " test 
CompareValue = \0"; 
ThresholdDuratiom = 0; 
State = 9; // CRITICAL 
Enabled = TRUE; 

}; 

instance of Microsof tHM_Corif igurationAssociation 

{ 

ParentPath = $DC1; 
ChildPath = $DC1T1; \/ V 

}; 



///////////////////////////////////X/////////////////////////////////// 

// COM+ MONITOR 

25 /////////////////////////////////////V///////////////////////////////// 
instance of Microsof tHM__PolledGetObjec\DataCollectorConf igurat ion AS 
$DC2 

{ 

GUID = » {E2F3E715-AEE4-454e-AB05-D(\62DBBFAA0F} " ; 
30 Name = "COM+ Application Monitor"; 

Description = "Monitors COM+ Data Objects"; 
CollectionlntervalMsecs = 60000; 
StatisticsWindowSize = 6; 
ObjectPath = 

35 "Microsof tComPlus_AppS tats . AppName=\ " \" , MaxIdl^eTimeSeconds = 180 " ; 

Properties = { "AbortedTransactionsPerSecond" , "AdminShutdowns" , 
"AppName" , "CommittedTransactionsPerSecond" , " Failure Shut down s " , 
"HandleCount" , "ObjectActivationsPerSecond" , 
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"ObjectCreationsPerSecond" , "ObjectPoolTimeouts" , "ThreadCount" , 
"Tirt^eoutShutdowns " , ' "TotalAbortedTransactions" , 
"Tot^ICommittedTransactions" , " Total Shut dovms" , "VirtualSize" , 
"WorkihgSetSize" } ; 

RetauireReset = FALSE; 

TargetNamespace = M root\\cimv2\\Microsof tHealthmonitor " ; 
TypeG^ID = "{E2F3E715-AEE4-454e-AB05-D062DBBFAA0F}"; 
Hidden \ TRUE; 
Enabled X FALSE; 

Message = \%EmbeddedCollectedInstance . AppName% Application 
monitor: %State% condition . \n(WMI Status: %CollectionErrorCode% 
%CollectionErrorDesctiption%) " ; 

ResetMessage = "&Name% monitor is Ok."; 

}; \ 

instance of Microsof tHM_Thr^esholdConf iguration AS $DC2T1 

GUID = " {C5F4BF3C-4115-\af 6-BE88 -289A0A310B93 } " ; 
Name = "Failure Shutdovms\> 0" ; 

Description = "Unexpected shutdowns since monitoring began."; 

PropertyName = 11 Fai lureShutopwns IK; 

TestCondition =!;//> \ / 

CompareValue = "0"; jh — ' 

State = 9; / \j 

ThresholdDuration =0; \ 

UseFlag =0; \ 

Hidden = TRUE; \ 

}; \ 

instance of Microsof tHM_Conf igurationAssociVtion 

ParentPath = $DC2; \ 
ChildPath = $DC2T1; \ 

instance of Microsof tHM_ThresholdConf iguration AS $DC2T2 

GUID = "{D9F360C9-6D23-4c9e-BOA2-lE200824BlDlS} "; 
Name = "Aborted Transactions/Sec > 0"; \ 
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Description = "Aborted transactions per second since the last 

query. 

P^pertyName = "AbortedTransactionsPerSecond" ; 
Te&tCondition =1; II > 
CompVreValue = " 0 " ; 
State\= 8; 

ThresholdDuration = 0; 
UseFlag V 0; 
Hidden = \RUE; 

}; 

instance of Micro^pf tHM_Conf igurationAssociation 

{ 



ParentPath = $E)C2; 
ChildPath = $DC^T2 ; 



}; 



instance of Microsof tHMJ^hresholdConf iguration AS $DC2T3 
{ 

GUID = n {EE354542-4Di^-4860-B963-5BD41069BlD7}"/ 
Name = "Error Code (from WMI) != 0"; 

Description = "Verify tne return error code from the Collection"; 
PropertyName = "Collecti\>nEftrorCode" ; 
UseFlag = 0; 

TestCondition =3; // "!=/Vt£st 
CompareValue = "0"; 
ThresholdDuration = 0; 
State = 9; // CRITICAL 
Enabled = TRUE; 

}; 

instance of Microsof tHM_Conf igurationXssociation 



{ 



}; 



ParentPath = $DC2; 
ChildPath = $DC2T3 ; 



//////////////////////////////////////////A//////////////////////////// 

II HTTP MONITOR 

/////////////////////////////////////////////y///////////////////////// 
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instance of Microsof tHM_PolledGetObjectDataCollectorConf iguration AS 
$DC3\ 

QUID = "{C90CD4CD-2297-lld3-BE00-0000F87A3912}"; 
NaVe = "Default HTTP Monitor"; 
Description = "HTTP Monitor"; 
ObjeWpath = 

"HTTPProvidar . Method=\ "GET\ " , Url=\ "http : // \ " , TimeoutMSecs=3 0000 , AuthTyp 
e=0, FollowReairects=l, ExtraHeaders=\ "User-Agent : Mozilla/4 . 0 
(compatible; MSIE 5.01; Windows 5.0; HealthMon 2 . 1) %0D%0A\ " " ; 

Properties = {"StatusCode", "StatusText " , "ResponseTime" , 
"ErrorDescriptioV" , "ContentLength" , "TextResponse " , "RawHeaders" , 
"ContentType" , "Cookie" , "LastModif ied" } ; 

RequireResetV= FALSE; 

TargetNamespaoe = "root\\cimv2\\Microsof tHealthmonitor " ; 
TypeGUID = " {C^0CD4CD-2297 -lld3 -BE00- 0000F87A3 912 } " ; 
Hidden = TRUE; \ 
Enabled = FALSE ; \ 

Message = "%EmbeddeidCol3|ectedInstance .URL% request failed: 
%State% condition. \nHTTP\Stat us : 
%EmbeddedCollectedInstance .AjBlfa tusCode% 
%EmbeddedCollectedInstance /statusText% 

%EmbeddedCollectedInstance'.ErVorDescription% \nResponse Time (msec) : 
%EmbeddedCollectedInstance . ResVonseTime% . \n (WMI Status : 
%CollectionErrorCode% %CollectiionErrorDescription%) " ; 

ResetMessage = n %EmbeddedCbllectedInstance .URL% request succeeded 
in %EmbeddedCollectedInstance . ResbonseTime% msecs. \nMonitor is Ok."; 

instance of Microsof tHM_ThresholdConf iguration AS $DC3T1 

GUID = " {9AB87A44-478A-4f3a-A6M:-BC0AlA80B7B3} " ; 
Name = "Status code (HTTP) >= 4 00 M ; 

Description = "Test if the returA status code is okay."; 
PropertyName = "StatusCode"; \ 
TestCondition = 4; // >= \ 
CompareValue = "400"; \ 
State =9; \ 
ThresholdDuration =0; \ 
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^UseFlag = 0; 
Ridden = TRUE ; 

}; 

instance \pf Microsof tHM_Conf igurationAssociation 

{ 

ParenNtPath = $DC3 ; 
ChildPkth = $DC3T1; 



}; 



instance of Microsof tHM_ThresholdConf iguration AS $DC3T2 
{ 

GUID = 11 { 3 0^C10D4 - DDFE-4127 -8214 - 9D82 7517E770 } " ; 
Name = "ResponseTime > 30"; 

Description = \'Test if the response time is too high"; 
PropertyName = YResponseTime" ; 
TestCondition = \; // > 
CompareValue = " 3 \o 0 0 " ; 
State = 9; 
ThresholdDuration = 
UseFlag = 0; 
Hidden = TRUE; 

}; 

instance of Microsof tHM_Conf igurationAssociation 

{ 



ParentPath = $DC3 ; 
ChildPath = $DC3T2 ; 

}; 

instance of Microsof tHM_ThresholdCor^f iguration AS $DC3T3 
{ 

GUID = « {AD03BA50-67FC-4308-BDB\-F194D6948356} " ; 
Name = "Error Code (from WMI) != 
Description = "Verify the return Arror code from the Collection"; 
PropertyName = "CollectionErrorCode\" ; 
UseFlag = 0; 

TestCondition = 3; // "!=" test 
CompareValue = "0" ; 
ThresholdDuration = 0; 
State = 9; // CRITICAL 
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\ Enabled = TRUE; 

instance of Microsof tHM_Conf igurationAssociation 

5 ParWtPath = $DC3; 

ChilVpath = $DC3T3; 

/////// iiiiiiNj i i i i i i i i i i i i i i i i i i i i i i i i i i n i i i i i i i i i i i i i i i i nun iiiii 

10 // WMI Instance\ 

////////////////\////////////////////////////////////////////////////// 
instance of Microrof tHM_PolledGetObjectDataCollectorConf iguration AS 
$DC4 \ 

15 CollectionlntervalMsecs = 60000; 

Description = "WM£ Instance Data Monitor"; 

GUID = "{C90CD4CA-\297-lld3-BE00-0000F87A3912} " ; 

Name = "WMI Instance^ Monitor " ; 

Object Path = " " ; \ / / 

20 Properties = {}; Af 

RequireReset = FALSE;' \ 

StatisticsWindowSize = 6A 

TargetNamespace = "ROOT\\qIMV2 " ; 

TypeGUID = " {C90CD4CA-2297 Vld3 -BE00 - 0000F87A3 912 } » ; 
25 Enabled = FALSE; \ 

Hidden = TRUE; \ 

Message = "%Name% monitor: %Soate% condition . \nlnstance : 
%InstanceName%\n (WMI Status : %CollectfdonErrorCode% 
%CollectionErrorDescription%) " ; \ 
30 ResetMessage = "%Name% monitor iA Ok. \nlnstance : %InstanceName% " ; 

}; \ 

instance of Microsof tHM_ThresholdConf igutiation AS $DC4T1 

GUID = " {92C94FA3-EE0A-4a50-9AC4-lC28O.A37CDE6} " ; 
35 Name = "Error Code (from WMI) != 0"; \ 

Description = "Verify the return error \code from the Collection"; 
PropertyName = "CollectionErrorCode" ; \ 
UseFlag =0; \ 
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10 



v TestCondition = 3; // "!= M test 
SompareValue = "0"; 
ThNresholdDuration = 0; 
State = 9; // CRITICAL 
Enabled = TRUE; 

}; 

instance of Microsof tHM_Conf igurationAssociation 

{ 



ParentPath\ = $DC4 ; 
ChildPath =\$DC4T1; 



}; 



□ 

CO 

m 

FU 

ru 

,5 

i! 

□ 

m 
a 
m 
o 



1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 iNi 1 1 1 1 / 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 / 1 1 1 1 1 1 

II Ping (ICMP) Monitor\ 
15 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 l\l 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 
instance of Microsof tHM_^oll^GetObjectDataCollectorConf iguration AS 
$DC5 
{ 

ObjectPath = "Microsof\:HM_IcmpPing . Address=\ "\ " , Timeout=10 00 " ; 
20 GUID = » {D442E727-971E-\ld3-BE93-0000F87A3912} " ; 

Name = "Ping (ICMP) Monitor"; 
Properties = 

{ "StatusCode" , "StatusDescription'\ "Address" , "Timeout" , "ResponseTime" } ; 
RequireReset = FALSE; 
25 TargetNamespace = "root\\cimv\2\\Microsof tHealthmonitor" ; 

TypeGUID = " {D442E727-971E-lld\-BE93-0000F87A3912 } " ; 
Enabled = FALSE; 

CollectionlntervalMsecs = 120000\ 
Hidden = TRUE; 

30 Message = "%Name% monitor: %State% \condition . \nPing failed or 

timed out in %EmbeddedCollectedInstance . T:omeout% msecs . \nPing Status: 
%EmbeddedCollectedInstance . StatusCode% 

%EmbeddedCollectedInstance . StatusDescriptiorf% \n(WMI Status: 
%CollectionErrorCode% %CollectionErrorDescription%) " ; 
35 ResetMessage = "%Name%: ping succeeded, \lonitor is Ok."; 

}; 



instance of Microsof tHM_ThresholdConf iguration AS\$DC5T1 
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GUID = "{CAC96A66-5E96-4753-B0E1-A6A691C60DFB} "; 
Name = "Ping Failed"; 

Description = "Watches for ping errors."; 
?ropertyName = "StatusCode" ; 

sstCondition = 1; // > 
CdtapareValue = "11000"; 
StaVe =9; // warning if only once 
ThreVholdDuration = 0; 
UseFlag = 0; 
Hidden \ TRUE; 

}; 

instance of Micr^sof tHM_Conf igurationAssociation 

{ 

ParentPath = ^DCS; 
ChildPath = $DOgTl; 

}; 



instance of Microsof tHM_ThryesholdConf iguration AS $DC5T2 
{ 

GUID = "{359EA98D-F84F-V548-AB31-960B84298AA9}" ; 
Name = "Error Code (f rom\ WMI) 11 ; 

Description = "Verify the\ return error code from the Collection"; 
PropertyName = "Collection^rrorCode" ; 
UseFlag = 0; 

TestCondition = 3; // "!=" t^st 
CompareValue = "0"; 
ThresholdDuration = 0; 
State = 9; // CRITICAL 
Enabled = TRUE; 

}; 

instance of Microsof tHM_Conf igurationAsspciation 

{ 



ParentPath = $DC5; 
ChildPath = $DC5T2 ; 



}; 
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^instance of Microsof tHM_ThresholdConf iguration AS $DC5T3 

GUID = "{F6FBF157-6742-4310-B14B-460B108CB5B9}"; 
Name = "Ping Timed Out (once)"; 
ascription = "Watches for ping timeouts."; 
srtyName = "StatusCode" ; 
stCondition =2; // == 
>areValue = "11000"; 
States = 8; // warning if only once 
ThresnoldDuration = 0; 
UseFlad= 0; 
Hidden =\ TRUE ; 

}; 

instance of Micr&sof tHM_Conf igurationAssociation 

{ 

ParentPath = ^>DC5 ; 
ChildPath = $d\s^|3 ; 

}; 

instance of Microsof tHM_NfhresholdConf iguration AS $DC5T4 
{ 

GUID = 11 {BC5897ED-69kA-4de6-946D-D678A82DD21A} " ; 
Name = "Ping Timed Ou\ (twice)"; 
Description = "WatchesXfor ping timeouts."; 
PropertyName = "StatusCqde" ; 
TestCondition =2; // == 
CompareValue = "11000"; 
State =9; // error if tw\ce 
ThresnoldDuration = 2; 
UseFlag = 0; 
Hidden = TRUE; 

}; 

instance of Microsof tHM_Conf igurationAssociation 
{ 

ParentPath = $DC5; 
ChildPath = $DC5T4; 

}; 
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/////////////////////////////////////////////////////////////////////// 
J / Service Monitor 

\/////////// /////////////////////////////////////////////////// //////// 
instance of Microsof tHM_PolledGetObjectDataCollectorConf iguration AS 
$Dd8 
{ \ 

\gUID = " {C90CD4CF-2297-lld3-BE00-0000F87A3912} " ; 
Name = "Service Monitor"; 

Properties = {"Started", "State", "Status", "DisplayName" } ; 

ObjWtPath = "Win32_Service .Name=\"\"" ; 

RequYreReset = FALSE; 

Targe uName space = "root\\cimv2 " ; 

TypeGUID = " {C90CD4CF-2297-lld3 -BE00 -0000F87A3912 } » ; 
Enabled \ FALSE; 
Hidden = TRUE; 

Message = "^EmbeddedCollectedlnstance .Name% service is 
%EmbeddedCollected\nstance .State% : %State% condition. \n(WMI Status: 
%CollectionErrorCode& %CollectionErrorDescription%) "; 

ResetMessage = V%Name% monitor is Ok."; 

}; yl 

instance of Microsof tHM_feresholdConf iguration AS $DC8T1 

{ \ 

GUID = "{48C4F538-60CD-4C03-A41C-A90DE6BEA5A7}"; 
Name = "Started != TruV» ; 

Description = "Verif ies\that the service is always in started 
state"; \ 
State =9; \ 
PropertyName = "Started"; \ 
TestCondition = 3; // != \ 
Compare Value = "1" ; \ 
ThresholdDuration =0; \ 
UseFlag =0; \ 
Hidden = TRUE; \ 

}; \ 

instance of Microsof tHM_Conf igurationAssociation 
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ParentPath = $DC8; 
ChildPath = $DC8T1; 

}; 

instance of Microsof tHM_ThresholdConf iguration AS $DC8T2 
{ 

GlkD = "{88494FA4-66C2-41a5-9B3C-8A26CFC6267B}"; 
Nanfte = "Error Code (from WMI) != 0"; 

Description = "Verify the return error code from the Collection"; 
Propem;yName = "Collect ionErrorCode " ; 
UseFlagy= 0; 

TestCondVtion = 3; // " !=" test 
CompareVa Jme = " 0 " ; 
ThresholdDuuration = 0; 
State = 9; /V CRITICAL 
Enabled = TRU^; 

}; 

instance of Microsof tlijYI_Conf igurationAssociation 

{ 

ParentPath = $DC8;\ 
ChildPath = $DC8T2;> 

}; 



/////////////////////////////A///////////////////////////////////////// 

// WMI Query 

////////////////////////////////V////////////////////////////////////// 
instance of Microsof tHM_PolledQueN^yDataCollectorConf iguration AS $DC10 

{ 

GUID = "{EFlD6A51-2759-lld3-9\90-O0AOCC406605}"; 
Name = "WMI Data Query"; 
Properties = {}; 
Query = " " ; 
RequireReset = FALSE; 
TargetNamespace = "ROOT\\CIMV2 " ; 

TypeGUID = " {EFlD6A51-2759-lld3-9390\-00A0CC406605} " ; 
Enabled = FALSE; 
Hidden = TRUE; 
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^Message = "%Name% monitor : %State% condition, \nlnstance : 
%Instan\eName% \n(WMI Status: %CollectionErrorCode% 
%CollectronErrorDescription%) " ; 

ResetMessage = "%Name% monitor is Ok. \nlnstance: 
%Ins tanceName% " ; 
}; \ 

instance of MiWosof tHM_ThresholdConf iguration AS $DC10T1 

GUID = "{24^C3B2B-8439-49ed-BD78-6549DBCB0524} »; 
Name = "Error Code (from WMI) != 0"; 

Description =\ n Verify the return error code from the Collection"; 

PropertyName =\ n CollectionErrorCode" ; 

UseFlag =0; \ 

TestCondition = 3\; // " !=" test 

CompareValue = "0"\ 

ThresholdDuration =\o; 

State = 9/ // CRITICAL * 

Enabled = TRUE; \ /I 

}; Y| 

instance of Microsof tHM_Conf igurationAssociation 

{ A 

ParentPath = $DC10; \ 
ChildPath = $DC10T1; \ 
}; \ 

1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 l\l 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 
II Windows Event Log Monitor \ 

1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 i\i 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 / 1 1 1 

II Note: the query below won't work on non-english machines due to a 
problem \ 

// with how the Type field is localized \(as a property value) by WMI. 
// For Beta, it's acceptable to leave thite as-is, for RTM see #63004. 
instance of Microsof tHM_EventQueryDataCol^ectorConf iguration AS $DC11 

{ \ 

Description = " " ; \ 

GUID = "{A89E51Fl-229F-lld3-BEO0-O00OFB7A3912} « ; 

Name = "Windows Event Monitor"; \ 
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\ Properties = {"EventCode", "SourceName" , "Type", "Message" , 
"Timeffienerated" , "CategoryString" , "User" , "LogFile" , 
"ColleationlnstanceCount " } ; 

Query = "select * from instancecreationevent where 

targetinstance isa \ "Win32_NtLogEvent\ " AND Targetlnstance . Logf ile=\ "\ " 
AND (Targetlnstance . Type=\ "error\ " OR Targetlnstance . Type=\ "warning\ " 
OR Targetlnstance .Type=\" audit f ailure\ " ) " ; 

Requi^eReset = FALSE; 

Local = Vms_4 09" ; 

TypeGUID \ " {A89E51Fl-229F-lld3 -BE00 -OO00F87A3912 } " ; 
Enabled = BtfVLSE; 
Hidden = TRUE; 

Collectionlnt^ervalMsecs = 1000; 

Message = "%Narisie% monitor : event received. %State% condition. 
\nLog : %EmbeddedColleotedInstance . LogFile%\nID : 
%EmbeddedCollectedInstance . EventCode %\nType : 
%EmbeddedCollectedInstanYe . Type%\nSource : 

%EmbeddedCollectedInstanc^. SourceName%\n%EmbeddedCollectedInstance . Mess 
age%\n(WMI Status: %CollecuaonErrorCode% 
%CollectionErrorDescription*\) " ; 

ResetMessage = "%Name% monitor is Ok."; 

instance of Microsof tHM_ThresholdConf iguration AS $DC11T1 

GUID = "{CF089291-D011-47D7-9^D6-64A55267FF29}"; 
Name = "# of Instances Collected > 0"; 
Description = ""; \ 
State =9; \ 
PropertyName = "CollectionlnstancSCount " ; 
TestCondition = 1; // > \ 
Compare Value = "0"; \ 
ThresholdDuration =0; \ 

Hidden = TRUE ; \ 
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instance of Microsof tHM_Conf igurationAssociation 

K 

\ ParentPath = $DC11; 
\ ChildPath = $DC11T1; 

}; \ 

instance of Microsof tHM_ThresholdConf iguration AS $DC11T2 
{ \ 

GUID = "{DB925564-8CF7-46f8-8291-238F289DCF7E}"; 
Name\= "Error Code (from WMI) != 0"; 

Description = "Verify the return error code from the Collection"; 
PropertyName = "CollectionErrorCode" ; 
UseFlag X 0; 

Test Condition =3; // "!=" test 
CompareValuk = "0" ; 
ThresholdDur action = 0; 
State = 9; // (CRITICAL 
Enabled = TRUE ;\ 

}; \ 

instance of Microsof tHM_conf igurationAssociation 

{ \ A 

ParentPath = $DC11; \/l 

ChildPath = $DC11T2; K\ 
}; ' \ 

1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 l\l 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 
II WMI Event Query \ 

1111/ III /III/ III III III II III III III IAI III II III III III III II ll/lll III II lll/l 
instance of Microsof tHM_EventQueryDa\aCollectorConf iguration AS $DC12 

{ \ 

GUID = n {C90CD4CB-2297-lld3-BE00^0000F87A3912}"/ 
Name = "WMI Event Query"; \ 
Description = ""; \ 
Properties = { " Collect ionlnstanceCouito " } ; 
Query = ""; \ 
RequireReset = FALSE; \ 
TargetNamespace = "R00T\\CIMV2 " ; \ 
TypeGUID = » {C90CD4CB-2297-lld3-BE00-0000Ffe7A3912} " ; 
Enabled = FALSE; \ 
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Hidden = TRUE; 

CollectionlntervalMsecs = 1000; 

Jessage = "%Name% monitor: %State% condition. \n(WMI Status: 
%CollecVionErrorCode% %CollectionErrorDescription%) "; 
Re^etMessage = "%Name% monitor is Ok. M ; 

}; 



5; 

o 
in 



instance of tyicrosof tHM_ThresholdConf iguration AS $DC12T1 
{ 

10 GUID = '\{2077B2B0-62FC-40al-8B6D-ABD54ClBBE46}"; 

Name = "m of Instances Collected > 0"; 
Description = » » . 
State = 9; 

PropertyNamd = "CollectionlnstanceCount " ; 
15 TestConditioA = 1; 

CompareValue 4 "0"; 
ThresholdDuratrpn = 0; 
UseFlag = 0; 
Hidden = TRUE; 



20 }; 



25 



30 



35 



instance of Microsof tHM_Co\if igurationAssociation 

{ 



ParentPath = $DC12; 
ChildPath = $DC12T1; 

}; 

instance of Microsof tHM_Thresho\dConf iguration AS $DC12T2 
{ 

GUID = "{61F1553A-8379-4a0f \8845-DC70153F8BF3}" ; 
Name = "Error Code {from WMI)\ != 0"; 

Description = "Verify the return error code from the Collection"; 
PropertyName = "CollectionError\:ode" ; 
UseFlag = 0; 

TestCondition = 3; // "!=" test 
CompareValue = "0" ; 
ThresholdDuration = 0; 
State = 9; // CRITICAL 
Enabled = TRUE; 
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m 
m 



m 



}; 

Instance of Microsof tHM_Conf igurationAssociation 

{\ 

ParentPath = $DC12; 
ChildPath = $DC12T2; 

}; 



////////V////////////////////////////////////////////////////////////// 
// Process^ Monitor 

10 lllllllllKl / 1 1 1 i 1 1 i II I i 1 1 1 1 i 1 1 1 i 1 1 1 1 1 1 1 1 1 1 i 1 1 1 1 i 1 1 1 1 i 1 1 1 i 1 1 1 1 1 1 1 II iill 

instance of Mi^crosof tHM_PolledQueryDataCollectorConf iguration AS $DC14 
{ 

GUID = "{0N3D537C8-CA9D-4731-93C2-3154D248EC60}"; 
15 Name = "Process Monitor"; 

Properties =V "State" , "Status"}; 

Query = "select * from Win32_Process where Name=\"\""; 
RequireReset = FALSE; 
Targe tName space =\ "root\\cimv2 " ; 
20 TypeGUID = *■ { 0DD53W 3 -CA9D-4731-93C2 -3154D248EC60 } " ; 

Enabled = FALSE; 
Hidden = TRUE; 

Message = "%Name% moniVor: %State% condition. \n (WMI Status; 
%CollectionErrorCode% %CollecWonErrorDescription%) "; 
25 ResetMessage = "%Name% monitor is Ok."; 

}; 



30 



35 



instance of Microsof tHMJThresholdConf iguration AS $DC14T1 
{ 



\ 



GUID = "{2A838470-AB97-4337-A5D6-E62FE7DE786C}"; 
Name = "Error Code (from WMI) l\ 0"; 

Description = "Verify the return ^rror code from the Collection"; 
PropertyName = "CollectionErrorCode" ; 
UseFlag = 0; 

TestCondition = 3; // "!=" test 
Compare Value = "0"; 
ThresholdDuration = 0; 
State = 9; // CRITICAL 
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V Enabled = TRUE; 

instance of Microsof tHM_Conf igurationAssociation 

{ \ 

\parentPath = $DC14; 
OhildPath = $DC14T1; 

}; \ 

iiiiiiiiiihiiiii a 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 in 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 a i a 1 1 1 

II TCP IP MONrrOR 

/////////////A///////////////////////////////////////////////////////// 

instance of Microsof bjHM__PolledGetObj ectDataCollectorConf iguration AS 
$DC15 \ri 

{ XJ 

GUID = "{B2^Bl\04-5F35-4167-BFlE-C9D008385138} M ; 
TypeGUID = " {B2FB1104-5F35-4167-BF1E-C9D008385138 } » ; 
Name = "TCP/IP PoVt Monitor"; 
Description = " " ; \ 

Obj ectPath = "Tcp Port Connect . Method=\ "GET\ " , TimeoutMsecs = 10000 " ; 
Properties = {"ServerV "Port", "TimeoutMsecs " , 
"ResponseTimeMsecs" , "ErrorCode" , "ErrorDescription" } ; 
RequireReset = FALSE; \ 

TargetNamespace = " root \\icimv2\\Microsof tHealthmoni tor" ; 

Enabled = FALSE; \ 

Hidden TRUE; \ 

Message = \ 
" %EmbeddedCollectedInstance . Server% : ^EmbeddedCollectedlnstance . Port% 
monitor failed. \nResponse Time (msec\ : 

%EmbeddedCollectedInstance . ResponseTimeMsecs% . \nConnection Status : 
%EmbeddedCollectedInstance . ErrorCode% \ 

%EmbeddedCollectedInstance . ErrorDescriptidh% \n (WMI Status : 
%CollectionErrorCode% %CollectionErrorDescr\ption%) "; 

ResetMessage = \ 
"%EmbeddedCollectedInstance . Server% : %EmbeddedOpllectedInstance . Port% 
monitor is Ok."; \ 

}; \ 

instance of Microsof tHM_ThresholdConf iguration As\$DC15Tl 
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\ GUID = "{0925C491-3323-lld4-928F-006097919914}"; 

\ Name = "Error Code (from WMI) != 0"; 

\ Description = "Verify the return error code from the Collection"; 
5 \ PropertyName = "CollectionErrorCode" ; 

\ UseFlag = 0; 
VTestCondition = 3; // "! = " test 
CompareValue = " 0 " ; 

10 Sta\e = 9/ // CRITICAL 

}; \ 

instance of Microsof tHM_ConfigurationAssociation 

ParentPaoh = $DC15; 
P 15 ChildPathV $DC15T1; 

instance of MicrosoftHM_ThresholdConf iguration AS $DC15T2 
In ^ \ 

l Z 20 GUID = M {59DD2B7G-A2B7-442a-A06A-2E0FC123E4F4}"; 

j; Name = "TCP Error Vode != 0"; 

j=~ s Description = "Verrfy the return error code from the Instance"; 

j;g UseFlag = 0; \ 

^ 25 TestCondition = 3; // \l = " test 

CompareValue = "0"; \ 

ThresholdDuration =0; \ 

State = 9; // CRITICAL \ 

}; \ 
30 instance of Microsof tHM_Conf iguratisonAssociation 

ParentPath = $DC15; \ 
ChildPath = $DC15T2; \ 

}; \ 

35 \ 

instance of Microsof tHM_ThresholdConf iguration AS $DC15T3 

{ \ 

GUID = "{9A12D556-BAC3-4126-AD58-F25F0ffO65713} M ; 
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